RE: How are cllassified this?

2007-04-04 Thread Rocco Scappatura
> > But It won't be indiscriminant in my case.. Is there any > other solution? > > Keep messages on the list. > > These are very simple messages that are exploiting an image > hosting service. There are very few spam signs in them. I > have decided that for the time being none of my users ar

Re: How are cllassified this?

2007-04-04 Thread Anthony Peacock
Rocco Scappatura wrote: full CHIME_BODY_IMAGESHACK/\bhttp:\/\/.*\.imageshack\.us/i describe CHIME_BODY_IMAGESHACKEmails containing imageshack.us URLs. scoreCHIME_BODY_IMAGESHACK2.0 Place these three lines in your local.cf file and restart any daemons. You can adjust the s

Re: How are cllassified this?

2007-04-03 Thread Anthony Peacock
Hi, Duncan Hill wrote: Yay, spammy has morphed, and the pattern that was working doesn't work (the morph appears to be making the filenames truly random now): http://img444.imageshack.us/img444/6834/mchd6.jpg http://img444.imageshack.us/my.php?image=5bsoda1.jpg http://img444.imageshack.us/img44

RE: How are cllassified this?

2007-04-03 Thread Duncan Hill
Yay, spammy has morphed, and the pattern that was working doesn't work (the morph appears to be making the filenames truly random now): http://img444.imageshack.us/img444/6834/mchd6.jpg http://img444.imageshack.us/my.php?image=5bsoda1.jpg http://img444.imageshack.us/img444/3335/68jo5.jpg the serv

RE: How are cllassified this?

2007-04-02 Thread John D. Hardin
On Mon, 2 Apr 2007, Duncan Hill wrote: > A good number of them seem to be coming from proper relays too - > at least one had SMTP AUTH header information. That, actually, is > slightly scary, because if it wasn't faked, it implies that the > malware spreading this spam is picking up more than e-m

RE: How are cllassified this?

2007-04-02 Thread Duncan Hill
On Mon, April 2, 2007 19:14, John D. Hardin wrote: > On Mon, 2 Apr 2007, Randal, Phil wrote: > > >> A large score for ImageShack uris, not a small one, would seem to >> be in order, otherwise a good proportion end up in people's mailboxes. > > I'm not familiar with ImageShack - is it public hosting

RE: How are cllassified this?

2007-04-02 Thread John D. Hardin
On Mon, 2 Apr 2007, Randal, Phil wrote: > A large score for ImageShack uris, not a small one, would seem to > be in order, otherwise a good proportion end up in people's > mailboxes. I'm not familiar with ImageShack - is it public hosting of images ala Flickr, such that people might legitimately

Re: How are cllassified this?

2007-04-02 Thread Duncan Hill
On Mon, April 2, 2007 16:34, Rocco Scappatura wrote: > What I can't figure out is if this is a new kind of spam or if I can > update it using the available rulesets (with sa-update or RDJ). > Search engine, fax scanting software? > http://img133.imageshack.us/img133/5553/webvq2.gif Custom rulese

RE: How are cllassified this?

2007-04-02 Thread Randal, Phil
iginal Message- > From: John D. Hardin [mailto:[EMAIL PROTECTED] > Sent: 02 April 2007 17:00 > To: SpamAssassin Users List > Subject: Re: How are cllassified this? > > On Mon, 2 Apr 2007, Rocco Scappatura wrote: > > > What I can't figure out is if this is a new ki

Re: How are cllassified this?

2007-04-02 Thread John D. Hardin
On Mon, 2 Apr 2007, Rocco Scappatura wrote: > What I can't figure out is if this is a new kind of spam or if I > can update it using the available rulesets (with sa-update or > RDJ). > > Can some one give an hint? > Received: from dsl51B7EDE5.pool.t-online.hu > (dsl51B7EDE5.pool.t-online.hu [81.